Missing condition for granting 'forwardable' flag on S4U2Self tickets

CVE-2024-2698

Summary

A flaw exists in FreeIPA concerning the initial implementation of MS-SFU by MIT Kerberos, where the condition for granting the 'forwardable' flag was overlooked in S4U2Self tickets. This flaw necessitated an adjustment in the check_allowed_to_delegate() function: a NULL target service argument indicates that the KDC is investigating general constrained delegation rules instead of a specific S4U2Proxy request. In FreeIPA version 4.11.0, the ipadb_match_acl() functionality was modified to reflect changes from upstream MIT Kerberos 1.20. Nonetheless, an oversight caused this mechanism to apply improperly, allowing S4U2Proxy requests to be granted regardless of the existence of a corresponding service delegation rule.

References